Software execution control system and software execution control program

TECHNICAL FIELD

0001The present invention relates to a software execution control system and software execution control program for updating various types of application software such as game software, office software for creating documents and drawings and the like to software of newer versions, and for controlling the execution of such software.

TECHNICAL BACKGROUND

0002Generally, in the case of application software such as game software or the like that operates in user computers such as (for example) personal computers, portable information terminals or the like, a plurality of different versions are prepared according to various types of software execution environments such the OS (operating system), language use, hardware construction and the like, or according to whether or not there is any software cost, payment of a fee or the like.

0003For example, even in the case of the same software, different versions may be prepared according to the language that is used, e.g., as in an English language edition, Japanese language addition, Chinese language edition or the like. Furthermore, it is fairly common for a version that is provided free of cost and a version that is provided for a fee to be prepared, and for the user to be induced to upgrade from the free software to the software that is provided for a fee. Such free software is also called a “test edition” or “trial edition”, and the software that is provided for a fee is called the “product edition” or “complete edition”. Compared to software of the same type that is provided for a fee, free software usually shows a partial limitation of the functions or a restriction on the trial use period or number of times of trial use permitted. Users who recognize the value of the software as a result of such trial use of free software accomplish upgrading of the software version by purchasing the software that is provided for a fee from a web site that provides this software, and downloading the purchased software, or by purchasing packaged software for a fee at a retail outlet.

0004Meanwhile, since software is digital data and can easily be copied, and since such software is characterized by the fact that such copying causes almost no deterioration in the software, illegal copying and unauthorized use are major problems. Accordingly, it has conventionally been the practice to discriminate by means of user verification or the like between regular users who have purchased the software (software license) and illegal users who have not obtained such a license, and to take steps so that only regular users are allowed to use the software.

0005For instance, a technique is known in which a product ID that is printed on the software package or recording medium is input when the software is installed, and it is thus ascertained whether or not this software is a regularly purchased product (e.g., see Japanese Patent Application Laid-Open No. 2002-258963, paragraph 0003).

0006Furthermore, a technique is also known in which key data that is required in order to use the software is requested from a license management server installed on the internet, and the system is devised so that in cases where the user is confirmed as a regular user by user verification, the user can acquire this key data from the license management server, and can start and use the software by means of this key data (e.g., Japanese Patent Application Laid-Open No. 2002-6972, Japanese Patent Application Laid-Open No. 2002-297254).

0007Conventional techniques that discriminate whether or not a user is a regular user by inputting a product ID (product key) are protective mechanisms that merely input an ID consisting of simple characters or symbols at the time of installation, and are therefore easily circumvented. Accordingly, software that has only a protective mechanism (copyright protection mechanism) of this type cannot in fact exclude illegal copying and unauthorized use.

0008A technique in which user verification is performed with a license management server, and key data is transmitted to the user computer to start the software in case where a normal verification is made, shows an improved protective power compared to a technique in which a product ID is simply input. However, the software is already placed in a state that allows starting in the user computer, and the user must wait to acquire the key data. Accordingly, if the software that is in a key data waiting state is illegally copied, and the key data is obtained by some other method, the protective mechanism can be circumvented, and the software can be used.

0009Meanwhile, in recent years, as the processing capacity of computers has increased and communications networks have achieved higher speeds, methods have been proposed for executing desired software at the time desired by users. The streaming system and the downloading system are known as distribution systems that are suitable for such on-demand distribution of software.

0010In the case of the streaming system, the user computer simultaneously performs playback while receiving software from a server. Then, data that is unnecessary is immediately discarded after this playback is completed. Accordingly, in the streaming system, since no data remains at the point in time at which the inspection by the user is completed, the software cannot be illegally copied without using some special type of software or the like. However, in the case of the streaming system, the software data must be transmitted each time that the user desires to inspect the software; accordingly, even in cases where a broad-area, high-speed communications network is provided, the traffic on the communications network is increased, and the burden on the server is also increased, if numerous users desire streaming distribution at the same time.

0011In the case of the downloading system, on the other hand, software that is desired by a user is downloaded from a server and accumulated in the user computer, and this software is executed in the user computer; accordingly, the time for which the data is flowing through the communications network is short, and distribution requests from numerous users can be handled. In the case of the downloading system, however, software remains as downloaded in the user computer; accordingly, illegal copying and the like can be performed more easily than in the case of the streaming system.

0012Furthermore, for example, it is a widespread practice for game programs and the like to be placed in circulation in a form in which these programs are fixed on various types of recording media such as CD-ROMs, DVD-ROMs, hard disks, semiconductor memories and the like. In such cases as well, game programs and the like are improperly copied, protective mechanisms are improperly destroyed, and the programs are improperly used, as was described above.

DISCLOSURE OF THE INVENTION

0013Accordingly, it is one object of the present invention to provide a software execution control system and software execution control program which are devised so that this system and program can suppress the improper use of software.

0014Furthermore, it is one object of the present invention to provide a software execution control system and software execution control program which are devised so that in the case of a downloading system that stores and executes software in a user computer, illegal copying and unauthorized use can be prevented.

0015Furthermore, it is one object of the present invention to provide a software execution control system and software execution control program which are devised so that the improper use of software during execution can be prevented beforehand.

0016Furthermore, it is one object of the present invention to provide a software execution control system and software execution control program which can actively control the monitoring efficiency with respect to improper use while taking into account the load conditions and the like.

0017Other objects of the present invention will become clear from the description of embodiments given below.

0018The software execution control system of the present invention is a system which updates first software that is installed in a user computer to second software; this system comprises a distribution part and verification part described later, and uses an execution control program which performs an operation that is characteristic of the present invention.

0019The distribution part is a part that distributes encoded second software and an execution control program for controlling the execution of this second software to the user computer via a communications network. The verification part is a part that performs user verification by means of a request from the execution control program installed in the user computer, and that transmits specified information that is required in order to decode and start the second software to the control execution program via the communications network in cases where it is confirmed that the user is a valid user. Furthermore, the second software is constructed so that this software can be started only by the starting information that is transferred from the execution control program, and the execution control program is constructed so that (1) the encoded second software is decoded on the basis of specified information received from the verification part, and is substituted for the first software, (2) the second software is started by creating starting information on the basis of specified information, and (3) the second software is disabled when the execution of the second software is completed.

0020The first software and second software are software of the same type, but of different versions. The first software may also be called old edition software, and the second software may also be called new edition software. For example, various types of application software such as games, movies, musical programs, cultural programs, educational programs, document preparation programs, graphics preparation programs, image editing programs and the like can be used as the first and second software. For example, the first software and second software differ in terms of the language used, the environment in which execution is possible (corresponding OS or the like), presence or absence of functional limitations and the like. Examples of user computers that can be used include workstations, personal computers, portable information terminals, portable telephones and the like.

0021Initially, the first software that has been installed in the user computer can be freely used by the user without performing the verification processing and the like described later. For example, the first software is installed in the user computer via a communications network such as the internet or the like from a software vendor site, or by means of packaged software from a retail outlet.

0022Next, if the user wishes to download the second software from the distribution part, the second software and an execution control program that controls the execution of the second software are transmitted to the user computer from the distribution part. The execution control program is executed in the user computer. The execution control program requests user verification from the verification part via the communications network. In regard to the method used for user verification, for example, this can be accomplished by making a comparison with a user ID, password, or data in which information that is specific to the user computer (e.g., MAC address (medial access control address) or the like) is registered beforehand. Furthermore, the system is not limited to these examples; for instance, verification can also be performed using biological information that is specific to the user, such as fingerprints, voice prints or the like.

0023In cases where the verification part verifies that the user is a valid user, specified information is transmitted from the verification part to the execution control program of the user computer. This specified information contains data that is required in order to decode the second software that is transmitted to the user computer in an encoded state, and in order to start the decoded second software.

0024Here, the second software is constructed so that this software can be started only by the starting information transferred from the execution control program. Specifically, the execution control program acts as dedicated “launcher software” that starts the second software.

0025Furthermore, the execution control program performs the following processing. (1) First, on the basis of specified information received from the verification part (i.e., utilizing a decoding key contained in this specified information), the execution control program decodes the second software. The decoded second software is substituted for the first software. (2) Next, on the basis of specified information received from the verification part (i.e., utilizing a starting argument contained in this specified information), the execution control program creates starting information (a starting statement consisting of a starting argument and the registry path for the decoded second software), and starts the second software by means of this starting information. As a result, the user can use the second software in the user computer. (3) Even after the second software is started, the execution control program monitors the conditions of execution of the second software, and disables the second software when the completion of the execution of the second software is detected. As a result, the user becomes unable to use the second software.

0026In cases where the user wishes to use the software again, the user must again undergo verification by the user verification part, and acquire specified information. Alternatively, the user computer may again be caused to access the distribution part, so that the user computer again downloads the second software. It is not necessary to download all of the second software again; if the system is constructed so that only the program part is downloaded again, the communications time can be shortened, so that traffic can be reduced. Furthermore, it is desirable that the specified information that is transmitted to the user computer from the verification part be encrypted.

0027When the execution of the second software is completed, the execution control program disables the second software. This disabling refers to a process that makes it impossible to start or execute the second software. Various methods can be used as disabling methods. For example, disabling can be accomplished by deleting all of the decoded second software. Furthermore, in cases where only a portion of the software is disabled, the second software can be restarted by receiving the deleted portion and the starting argument from the verification part. Alternatively, in cases where the second software includes a program and an accompanying data group, the second software can be disabled by deleting only the program. Furthermore, if the encoded data prior to decoding is stored, the second software can be restarted merely by receiving specified information from the verification part. The term “accompanying data group” refers to a data group other than the program that is used in the execution of the above mentioned program; examples of such data include image data, voice data, musical data, text data and the like.

0028In a preferred embodiment, the execution control program is constructed so that this program can handle a plurality of different types of second software, and the specified information that is transmitted to the execution control program by the verification part includes storage destination address information and a starting argument for the second software that is to be started, and decoding key data for decoding the second software.

0029The execution control program that controls real-time on-line verification via the communications network and the starting and completion of the second software is created separately from the second software. Accordingly, numerous different types of second software can be handled merely by preparing a single type of execution control program.

0030In a preferred embodiment, the execution control program transmits verification information including machine information that is specific to the user computer and encrypting key into to the verification part, the verification part performs user verification on the basis of at least this machine information, and in cases where it is confirmed that the user is a valid user, the verification part encrypts the specified information with the encrypting key information and transmits this specified information to the execution control program via the communications network; furthermore, the system is constructed so that a plurality of sets of machine information can be registered in the verification part.

0031For example, machine information that is specific to the user computer may include MAC addresses or the like. In addition, user computer construction information (e.g., amount of memory installed, CPU specifications, sound chip and graphic accelerator product names and the like) may also be used. A plurality of types of machine information can be registered in the verification part. As a result, users who have properly purchased the second software can utilize the same second software using a plurality of user computers such as home personal computers, workplace personal computers and the like.

0032In a preferred embodiment, in cases where the verification part has confirmed that the user is a valid user, the verification part transmits second software list data that can be started by the user to the user computer, and transmits specified information relating to the second software selected from the list data to the execution control program via the communications network.

0033There may also be cases in which the user has formally purchased licenses for a plurality of different types of second software; in such cases, following user verification, the verification part transmits list data showing examples of the names or the like of second software that can be utilized by the user to the user computer. The user selects second software that he wishes to start from the list menu showing software that can be started (i.e., that can be utilized). As a result, the verification part creates specified information for decoding and starting the selected second software, and transmits this specified information to the execution control program.

0034In a preferred embodiment, the execution control program causes a function which acquires machine information that is specific to the user computer, a function which creates encrypting key information, a function which requests user verification from the verification part, and which transmits at least machine information and encrypting key information to the verification part, a function which allows the user to select one set of second software from the list data of startable second software that is received from the verification part, and which notifies the verification part of the selected second software, a function which receives specified information in which storage destination address information for the selected second software in the user computer, a starting argument and decoding key information are encrypted by means of at least encrypting key information, a function which decrypts the encrypted specified information using at least the encrypting information, a function which decodes the second software in the user computer by means of the decrypted decoding key information, a function which creates starting information on the basis of the decrypted starting argument and storage destination address information, a function which starts the decoded second software by means of the created starting information, and a function which monitors the conditions of execution of the started second software, and disables the second software when the execution of the second software is completed, to be realized in the user computer.

0035Furthermore, in a preferred embodiment, the second software contains a program and an accompanying data group, and at least one of these, i.e., the program or accompanying data group, is updated.

0036Here, the first software that is installed in the user computer can be executed without receiving verification by means of the verification part until this first software is replaced by the second software.

0037Furthermore, in a preferred embodiment, the execution control program is constructed as a program that cannot be forcibly ended separately from the second software.

0038Specifically, for example, the execution control program can be constructed so that the execution control program alone cannot be forcibly ended using a program that manages tasks in operation or the like. This is done so that monitoring by the execution control program cannot be stopped and the second software alone copied or the like. More concretely, if the execution control program is created as a device driver that does not designate hardware (since hardware is not designated, this is not strictly a device driver), since this program is constructed as a program that is closer to the OS side than an application program, or as a program that forms a part of the OS, it is difficult to forcibly end this program as in the case of an ordinary application program. In addition to driver programs, BIOS (basic input/output systems) are also known as programs that are difficult to end forcibly. However, since BIOS basically have only the function of directly transmitting and receiving data with hardware, such BIOS cannot perform a high degree of control such as decrypting encrypted data, monitoring the execution of the above mentioned second software or the like. Thus, for example, by constructing the execution control program as an intermediate program that is positioned between the OS and application program (second software) as in the case of a device driver, it is possible to prevent misuse while causing a high degree of processing to be performed.

0039In a preferred embodiment, the distribution part and verification part are realized in respectively separate computers.

0040For example, the distribution part that distributes the second software and execution control program can be installed for each software firm, and the verification part that performs verification at the time of starting of the second software can be installed for each country, each region or each group of software firms.

0041The present invention can also be grasped as the invention of a program.

0042Specifically, this is an execution control program which updates the first software installed in the user computer to the second software, and controls the execution of this second software, and is a software execution control program which causes a first function that communicates with an outside verification part via a communications network, and that requests user verification, a second function that creates starting information for starting the second software on the basis of specified information received from the verification part, a third function that decodes the second software on the basis of specified information received from the verification part, a fourth function that replaces the pre-updating software already installed in the user computer with the decoded second software, a fifth function that starts the second software by means of the created starting information, and a sixth function that monitors the conditions of execution of the second software, and that disables the second software when the execution of the second software is completed, to be realized in the user computer.

0043Furthermore, the present invention can also be grasped as a software updating method.

0044Specifically, this is a software updating method comprising the steps of notifying the user that the freely usable first software installed in the user computer can be updated to the second software, connecting the user computer via a communications network to a distribution computer that distributes the second software, and requesting updating to the second software, transmitting the encoded second software and an execution control program for controlling the execution of this second software from the distribution computer to the user computer via a communications network, connecting the user computer and verification computer via the communications network and requesting user verification from the verification computer by means of the execution control program started in the user computer, decoding the second software on the basis of specified information transmitted to the user computer from the verification computer in cases where the user is confirmed as a valid user by user verification, creating starting information for starting the second software on the basis of specified information received from the verification computer, starting the second software by means of the created starting information, and monitoring the execution of the second software and disabling the second software when the execution of the second software is completed.

0045The management computer according to another aspect of the present invention controls the operation of the execution control program by performing communications with the execution control program which is installed in the user computer together with the application software and monitoring program. Furthermore, this management computer comprises a verification part which performs user verification on the basis of requests from the execution control program, an information transmission part which transmits first information that is required for the execution control program to start the application software in cases where it is confirmed by the verification part that the user is a valid user, and a continuing execution management part which manages whether or not continuation of the execution of the application software is allowed on the basis of continuation confirmation communications performed with the execution control program at a specified time.

0046In one aspect of the present invention, the continuing execution management part compares first identification information acquired by continuation confirmation communications and second identification information associated beforehand with user verification, and in cases where both sets of identification information correspond, the continuing execution management part allows the execution control program to continue execution of the application software, while in cases where the respective sets of identification information do not correspond, the continuing execution management part prohibits the execution control program from continuing the execution of the application software.

0047In one aspect of the present invention, the continuing execution management part sets first identification information corresponding to the second identification information in the execution control program beforehand.

0048In one aspect of the present invention, the continuing execution management part sets a specified time in the execution control program beforehand, and when this preset specified time arrives, continuation confirmation communications are caused to take place from the execution control program to the continuing execution management part.

0049In one aspect of the present invention, the continuing execution management part can set the specified time in a variable manner.

0050In one aspect of the present invention, the continuing execution management part can set the specified time in a variable manner while taking into account at least the predicted future load conditions.

0051In one aspect of the present invention, the monitoring program respectively monitors the operating conditions of the application software and the execution control program, and in cases where either the application software or the execution control program stops operating, the monitoring program respectively shuts down the application software and the execution control program, and also shuts itself down; furthermore, the execution control program respectively monitors the operating conditions of the application software and the monitoring program, and in cases where the application software or monitoring program stops operating, the execution control program respectively shuts down the application software and the monitoring program, and also shuts itself down.

0052The computer program according to still another aspect of the present invention is a program which causes a computer to function as an execution control part that controls the execution of application software, and a monitoring part that respectively monitors the operating conditions of the application software and execution control part, the execution control part comprises a function which requests user verification by communicating with the management computer, a function which starts the application software on the basis of first information received from the management computer, a function which performs continuation confirmation communications with the management computer, and a function which shuts down the operation of the application software in cases where continuation of the execution of the application software is prohibited by the continuation confirmation communications, and the monitoring part comprises a function which respectively monitors the operating conditions of the application software and the execution control part, and a function which respectively shuts down the application software and the execution control part, and which also shuts itself down, in cases where either the application software or the execution control part stops operating.

BRIEF DESCRIPTION OF THE DRAWINGS

0053<figref idref="DRAWINGS">FIG. 1</figref> is an explanatory diagram showing an overall outline of a software execution control system constituting an embodiment of the present invention;

0054<figref idref="DRAWINGS">FIG. 2</figref> shows the structures of the data bases and the like, with <figref idref="DRAWINGS">FIG. 2(a)</figref> showing a user information data base, <figref idref="DRAWINGS">FIG. 2(b)</figref> showing a game information data base, and <figref idref="DRAWINGS">FIG. 2(c)</figref> showing how encrypted starting information is embedded in the HTML header and transmitted;

0055<figref idref="DRAWINGS">FIG. 3</figref> shows the schematic structures of programs, with <figref idref="DRAWINGS">FIG. 3(a)</figref> showing a game program, and <figref idref="DRAWINGS">FIG. 3(b)</figref> showing the structure of the execution control program;

0056<figref idref="DRAWINGS">FIG. 4</figref> is an explanatory diagram showing how an old edition of a game program installed in the computer is updated to a new edition of this game program, and how the starting of this program is controlled;

0057<figref idref="DRAWINGS">FIG. 5</figref> is a flow chart showing the processing that is performed when a game program and an execution control program are installed;

0058<figref idref="DRAWINGS">FIG. 6</figref> is a flow chart showing the on-line verification and the like performed between the execution control program and the verification computer;

0059<figref idref="DRAWINGS">FIG. 7</figref> is an explanatory diagram showing an overall outline of a software execution control system constituting an embodiment of the present invention;

0060<figref idref="DRAWINGS">FIG. 8</figref> shows the structures of the data bases and the like, with <figref idref="DRAWINGS">FIG. 8(a)</figref> showing a user information data base, <figref idref="DRAWINGS">FIG. 8(b)</figref> showing a game information data base, and <figref idref="DRAWINGS">FIG. 8(c)</figref> showing a monitoring condition data base;

0061<figref idref="DRAWINGS">FIG. 9</figref> is a flow chart showing an outline of the overall operation of the software execution control system;

0062<figref idref="DRAWINGS">FIG. 10</figref> is a flow chart showing an outline of the processing of the periodically performed continuation confirmation communications;

0063<figref idref="DRAWINGS">FIG. 11</figref> is a flow chart showing an outline of the processing that determines the time at which the next continuation confirmation communications are to be performed;

0064<figref idref="DRAWINGS">FIG. 12</figref> is a flow chart showing an outline of the processing whereby the game manager and monitoring program monitor each other; and

0065<figref idref="DRAWINGS">FIG. 13</figref> is an explanatory diagram showing an overall outline of a software execution control system constituting still another embodiment of the present invention.

BEST MODE FOR CARRYING OUT THE INVENTION

0066Embodiments of the present invention will be described in detail below with reference to <figref idref="DRAWINGS">FIGS. 1 through 13</figref>.

0067First, a first embodiment will be described with reference to <figref idref="DRAWINGS">FIGS. 1 through 6</figref>. <figref idref="DRAWINGS">FIG. 1</figref> is an explanatory diagram which shows an overall outline of the software execution control system. In the present embodiment, a system in which a game program is updated on-line will be described as an example.

0068The distribution computer <b>10</b> distributes a new edition of a game program <b>40</b> and an execution control program <b>50</b> to respective user computers <b>30</b> via a communications network such as the internet or the like. The distribution computer <b>10</b> can be constructed as a server which is respectively installed for each software firm (vendor).

0069First, for a new edition program registered in the game program data base <b>12</b>, the distribution computer <b>10</b> performs registration in the verification computer <b>20</b> in advance (S<b>1</b>). For example, data such as the name, type, retail price, data size, version information and the like for a new edition game program is registered in the verification computer <b>20</b> from the distribution computer <b>10</b>. Of course, in cases where the distribution computer <b>10</b> and verification computer <b>20</b> are constructed as an integral unit, such notification via an external network is not absolutely necessary.

0070When the distribution control part <b>11</b> of the distribution computer <b>10</b> receives a program updating request from the user computer <b>30</b>, this distribution control part <b>11</b> reads out the game program <b>40</b> desired by the user from the game program data base <b>12</b>, and distributes this program to the user computer <b>30</b> (S<b>2</b>). Here, it should be noted that the new edition of the game program <b>40</b> is not distributed to the user computer <b>30</b> alone, but is rather distributed to the user computer <b>30</b> together with the execution control program <b>50</b> that manages the starting, deletion and the like of the game program <b>40</b>.

0071For example, the verification computer <b>20</b> can be constructed as a server that is respectively installed for each group or organization to which the software firm belongs. Furthermore, the present invention is not limited to this; verification computers <b>20</b> may also be installed for each software firm. The verification computer <b>20</b> comprises a verification part <b>21</b>, a fee processing part <b>22</b>, a starting information transmission part <b>23</b>, a user information data base <b>24</b>, and a game information data base <b>25</b>.

0072The verification part <b>21</b> is a part which performs user verification on the basis of specified verification data transmitted from the execution control program <b>50</b> of the user computer <b>30</b>. Details will be described later; however, the user verification data includes user identification information (a user ID), a password (PW), a MAC address (media access control address) and the like.

0073The fee processing part <b>22</b> is a part which charges the user a fee when permission to use the updated game program <b>40</b> is given. Various methods may be used as the method of levying a fee. For example, the user may be asked to pay a fee for the game program at one time (purchase of the program), or the user may pay a fee each time that he uses the program. Alternatively, the system may be devised so that a fee is charge at a specified period or for a specified number of times of use. Furthermore, various payment methods such as payment by credit card, payment by electronic money order or the like may be used.

0074The starting information transmission part <b>23</b> transmits starting information that is necessary in order to decode and start the new edition of the game program <b>40</b> stored in a storage device (e.g., hard disk or the like) of the user computer <b>30</b> to the execution control program <b>50</b> of the user computer <b>30</b>.

0075The user undergoes verification with the verification part <b>21</b> of the verification computer <b>20</b> via the execution control program <b>50</b>, and in cases where it is verified that the user is a valid user who has paid the purchase price (or use fee) of the game program <b>40</b> (S<b>3</b>), the starting information is transmitted to the execution control program <b>50</b> from the starting information transmission part <b>23</b> (S<b>4</b>). In cases where a user who has not yet paid the fee for the game program <b>40</b> accesses the verification computer <b>20</b>, the starting information is transmitted to the execution control program <b>50</b> after fee processing is performed via the fee processing part <b>22</b>.

0076Now turning our attention to the construction of the user computer <b>30</b>, this user computer <b>30</b> is constructed (for example) as a computer such as a personal computer, workstation, portable information terminal, portable telephone or the like. The user computer <b>30</b> comprises (as necessary) computer resources such as a calculation processing unit (CPU), main memory, auxiliary memory, external input-output circuit and the like, and these respective resources are appropriately used by the game program <b>40</b> and execution control program <b>50</b>.

0077The new edition of the game program <b>40</b> and the execution control program <b>50</b> that are transmitted to the user computer <b>30</b> from the distribution computer <b>10</b> are installed in the user computer <b>30</b> by an accessory installer (as will be described later). Furthermore, the execution control program <b>50</b> performs user verification with the verification computer <b>20</b>, and when the starting information is input, the game program <b>40</b> is started (S<b>5</b>). Furthermore, since the old edition of the game program that was already installed in the user computer prior to the installation of the new edition of the game program <b>40</b> is replaced by the new edition of the program, the old edition of the game program <b>40</b> cannot subsequently be used.

0078The user can utilize the new edition of the game program <b>40</b> via the user computer <b>30</b>. Furthermore, when the user finishes the game and completes the game program <b>40</b>, the execution control program <b>50</b> disable the game program <b>40</b> by deleting the game program <b>40</b> or the like (S<b>6</b>). In cases where the user again utilizes the game program <b>40</b>, the user again accesses the verification computer <b>20</b>, undergoes user verification, and acquires starting information.

0079Here, since the new edition of the game program <b>40</b> is stored as an encrypted file prior to decoding in the storage device of the user computer <b>30</b>, in cases where the game program <b>40</b> is to be reused, it is necessary merely to acquire information that is used for the decoding of this encrypted file (i.e., a decoding key) and information that is used for the starting of the program from the verification computer. Specifically, in the present embodiment, the new edition of the game program <b>40</b> is stored as an encrypted file on the local disk of the user computer <b>30</b>, and each time that the game is played, on-line verification is performed with the verification computer <b>20</b>, and the encrypted game program <b>40</b> is decoded and started. Then, after the game is finished, the decoded game program <b>40</b> is disabled by being deleted.

0080Next, <figref idref="DRAWINGS">FIG. 2</figref> is an explanatory diagram showing examples of construction of the user information data base <b>24</b> and game information data base <b>25</b> used by the verification computer <b>20</b>. Furthermore, the contents of the respective data bases <b>24</b> and <b>25</b> shown in <figref idref="DRAWINGS">FIG. 2</figref> are merely examples; it is not necessary that all of the items shown in the figure be provided.

0081For example, the user information data base <b>24</b> shown in <figref idref="DRAWINGS">FIG. 2(a)</figref> is constructed by respectively associating the user ID, password, a plurality of MAC addresses <b>1</b> through n, game IDs <b>1</b> through n that specify the purchased game programs, and other information. Here, the reason that the system is devised so that a plurality of MAC addresses <b>1</b> through n can be registered is that cases in which a single user uses a game program <b>40</b> by using a plurality of different user computers <b>30</b> are also taken into account. Accordingly, for example, the user can utilize the game program <b>40</b> via different information processing terminals such as a workplace computer, home computer and the like. Examples of other information that can be used include the user's name, age and address, the number of times that the game is played, the number of points scored (e.g., in cases where points are awarded in accordance with the game purchase price, number of times played or the like) and the like.

0082Furthermore, for example, the game information data base <b>25</b> shown in <figref idref="DRAWINGS">FIG. 2(b)</figref> is constructed by associating the game ID, name of the game, game information (information indicating the registry path of the game program), decoding key that is used to decode the encrypted game program <b>40</b>, starting argument that is used to start the decoded game program <b>40</b>, and other information. Examples of other information that can be used include the type of the game (role playing game, combat game, presence or absence of designation for adults or the like), data size, copyright management information and the like.

0083As is shown in <figref idref="DRAWINGS">FIG. 2(c)</figref>, the game information, decoding key and starting argument are embedded in encrypted HTML (hyper text markup language) data, and are transmitted to the user computer <b>30</b>. Specifically, the starting information (game information, decoding key, starting argument) is encrypted by means of an encrypting key and MAC address created on the side of the user computer <b>30</b>, and is embedded in (for example) the HTML header part. Accordingly, in response to an HTTP (hyper text transport protocol) request from the user computer <b>30</b>, the verification server <b>20</b> creates encrypted starting information, and returns an HTTP response containing this encrypted starting information to the user computer <b>30</b>.

0084Next, <figref idref="DRAWINGS">FIG. 3</figref> is an explanatory diagram which shows the schematic construction of the game program <b>40</b> and the execution control program <b>50</b>.

0085As is shown in <figref idref="DRAWINGS">FIG. 3(a)</figref>, the game program <b>40</b> includes a program proper <b>41</b> and an accompanying data group <b>42</b>. Examples of data in the data accompanying group <b>42</b> include movie data, still image data, graphics data, musical data, voice data, text data and the like.

0086In the new edition of the game program <b>40</b>, compared to the old edition of the program, either the program proper <b>41</b> or the accompanying data group <b>42</b>, or both, are newly created. In cases where both the program proper <b>41</b> and the accompanying data group <b>42</b> are newer than in the old edition, both the program proper <b>41</b> and accompanying data group <b>42</b> are replaced by new editions. In cases where only the accompanying data group <b>42</b> is new or in cases where only the program proper <b>41</b> is new, either the accompanying data group <b>42</b> or the program proper <b>41</b> is replaced by a new edition.

0087As is shown in <figref idref="DRAWINGS">FIG. 3(b)</figref>, the execution control program <b>50</b> causes the respective functions of an encryption information producing part <b>51</b>, a verification request part <b>52</b>, a game selection part <b>53</b>, a decryption part <b>54</b>, a starting part <b>55</b>, a decoding part <b>56</b> and an execution monitoring part <b>57</b> to be realized in the user computer <b>30</b>. As one example, the execution control program <b>50</b> is constructed as a device driver that specifies the device. Accordingly, for example, the execution control program <b>50</b> differs from application programs such as game programs or the like in that this execution control program can be constructed so that this program cannot be ended from a task management program or the like.

0088For example, besides creating an encrypting key on the basis of time information acquired from an internal timer in the user computer <b>30</b>, the encryption information producing part <b>51</b> acquires MAC addresses and the like of the user computer <b>30</b>.

0089The verification request part <b>52</b> internally calls up the network access function mounted in the user computer <b>30</b>, accesses the verification computer <b>20</b>, transmits the encrypting key, MAC address, user ID and password to the verification computer <b>20</b>, and requests user verification.

0090The game selection part <b>53</b> allows the user to selected desired games from a list menu that is transmitted to the user computer <b>30</b> from the verification computer <b>20</b> after user verification is completed. This list menu displays the game programs that can be utilized (started) by the user in a list format, and can be created on the basis of purchased game IDs in the user information data base <b>24</b>.

0091The starting information that is used to start the game program <b>40</b> selected by the user in accordance with the MAC address and the encrypting key created by the encryption information producing part <b>51</b> is encrypted and transmitted to the user computer <b>30</b>. The decryption part <b>54</b> decrypts the encrypted starting information on the basis of the encrypting key and MAC address.

0092The decoding part <b>56</b> decodes the encrypted game program <b>40</b> by means of the decrypted decoding key. Furthermore, the encrypted file is stored “as is”. The starting part <b>55</b> creates a starting statement and starts the decoded game program <b>40</b> on the basis of the decrypted game information and starting argument. The starting statement is constructed from the registry path and starting argument of the game program.

0093When the game program <b>40</b> is started, the execution monitoring part <b>57</b> monitors the conditions of execution of the game program <b>40</b>, and when the game program <b>40</b> ends, the decoded program proper <b>41</b> is deleted. Furthermore, the decoded accompanying data group may also be deleted along with the game program proper <b>41</b>. Furthermore, when this deletion is performed, all of the program or data may be deleted, or a portion of the program and data may be deleted.

0094Next, <figref idref="DRAWINGS">FIG. 4</figref> is an explanatory diagram which shows in model form how the game program is updated to the most recent edition by the present system.

0095First, as is shown in <figref idref="DRAWINGS">FIG. 4(a)</figref>, the old edition of the game program has already been installed in the user computer <b>30</b>. Moreover, in the figures, the old edition of the game program prior to upgrading of the version is indicated as the “initial program”, and the new edition of the game program whose version is upgraded is indicated as the “updated edition of the program”.

0096For example, the user installs the old edition of the game program <b>40</b>A which is fixed on a storage medium such as a CD-ROM, DVD-ROM, memory or the like in the user computer <b>30</b>, and utilizes this program (S<b>11</b>). Alternatively, the user may also acquire the old edition of the game program <b>40</b>A via a communications network such as the internet or the like. This old edition of the game program <b>40</b>A can be used without undergoing on-line verification with the verification computer <b>20</b>. However, once updating has been performed by the present updating system, utilization is impossible without undergoing on-line verification even in cases where the updated edition of the program is the old system.

0097The user utilizing the old edition of the game program <b>40</b>A is notified that updating to the new edition of the game program <b>40</b> is possible. This notification can be performed by various methods.

0098For example, the first method is a method in which the user is informed, either actively or passively, that the old edition of the game program <b>40</b>A can be updated to the new edition of the game program <b>40</b>, and at the same time, the URL (uniform resource locator) of the distribution computer <b>10</b> is displayed. As active notification, for example, it is conceivable that the fact that updating is possible might be displayed on the screen along with the URL at the time that the game is started or at the time that the game is ended. As passive notification, for example, it is conceivable that the fact that updating is possible might be displayed along with the URL of the distribution computer in the help menu for the old edition of the game program. In either case, a system that is convenient for the user can be obtained by constructing the system so that the web browser <b>31</b> is started and the user computer <b>30</b> is automatically caused to access the distribution computer merely by clicking on the URL.

0099The second method is a method in which the user is notified either actively or passively of the fact that updating to the new edition of the game program is possible, along with the URL of the distribution computer <b>10</b>, via an electronic medium. For instance, an email that is addressed to the user can be cited as an example of active notification. Furthermore, for instance, advertising of the new edition of the game program <b>40</b> by means of a web site (for example, the distribution computer <b>10</b> or the like) is conceivable as an example of passive notification.

0100In addition, advertising via a paper medium such as a game magazine, computer magazine or the like, or advertising to the community as in a game program fan society formed on network, is conceivable as a third method.

0101Thus, the user can be notified of the existence of the new edition of the game program <b>40</b>. As is shown in <figref idref="DRAWINGS">FIG. 4(b)</figref>, a user who desires updating accesses the distribution computer <b>10</b> via the web browser <b>31</b>, and requests updating to the new edition of the game program <b>40</b> (S<b>12</b>).

0102As is shown in <figref idref="DRAWINGS">FIG. 4(c)</figref>, the distribution computer <b>10</b> transmits the new edition of the game program <b>40</b> (including the accompanying data group as well) desired by the user to the user computer <b>30</b> via the communications network (S<b>13</b>). Furthermore, the execution control program <b>50</b> is also formed into a set together with the new edition of the game program <b>40</b>, and is transmitted to the user computer <b>30</b> (S<b>13</b>). The new edition of the game program <b>40</b> and the execution control program <b>50</b> are stored in the storage device of the user computer <b>30</b>.

0103A dedicated installer is attached as an accessory to the new edition of the game program <b>40</b> and the execution control program <b>50</b>. The new edition of the game program <b>40</b> the execution control program <b>50</b> are installed in the user computer <b>30</b> by means of this installer. When the execution control program is started, as is shown in <figref idref="DRAWINGS">FIG. 4(d)</figref>, the execution control program <b>50</b> calls up a network access function, accesses the verification computer <b>20</b>, and performs user verification and purchase processing (fee processing) with the verification computer <b>20</b> (S<b>14</b>). After this user verification and fee processing are completed, the verification computer <b>20</b> transmits encrypted starting information to the execution control program <b>50</b> of the user computer <b>30</b> (S<b>15</b>).

0104The execution control program <b>50</b> decrypts the encrypted starting information, and extracts the decoding key, starting argument and the like. Then, the execution control program <b>50</b> decodes and starts the game program <b>40</b>. The conditions of execution of the game program <b>40</b> are monitored by the execution control program <b>50</b>.

0105As is shown in <figref idref="DRAWINGS">FIG. 4(e)</figref>, when the user finishes playing the game, and the game program <b>40</b> ends, the execution control program <b>50</b> disables the new edition of the game program <b>40</b> by deleting this program (S<b>16</b>).

0106As one example, only the new edition of the game program <b>40</b> that has been decoded and placed in a state that allows execution (a state that allows starting by the input of the starting statement); here, the encrypted file (prior to decoding) that is acquired from the distribution computer <b>10</b> can be stored “as is” in the storage device of the user computer <b>30</b>.

0107As a result, in cases where the user wishes to play the game program <b>40</b> again, the user need merely access the verification computer <b>20</b>, undergo on-line user verification, and again acquire starting information from the verification computer <b>20</b> (S<b>17</b>). Since there is no need to re-acquire the encrypted game program <b>40</b> from the distribution computer <b>10</b>, the trouble of downloading can be avoided, and the burden on the communications network can be reduced.

0108A method in which only the starting information of the game program <b>40</b> is thus re-acquired in cases where the game program <b>40</b> is to be played again is convenient. However, the present invention is not limited to such a method; it would also be possible to devise the system so that the encrypted program prior to decoding is re-acquired from the distribution computer <b>10</b>. Furthermore, it would also be possible to delete only the decoded program proper <b>41</b>, and to leave the accompanying data group <b>42</b> “as is”.

0109Next, details of the processing of the present system will be described with reference to <figref idref="DRAWINGS">FIGS. 5 and 6</figref>. The flow charts shown in the figures indicate the rough flow of the processing, and differ from the actual programs.

0110<figref idref="DRAWINGS">FIG. 5</figref> shows the processing used for the installation of the installation of the new edition of the game program <b>40</b> and execution control program <b>50</b> stored in the storage device of the user computer <b>30</b> and the like.

0111The game program <b>40</b> and execution control program <b>50</b> are stored in the user computer <b>30</b> in the form of encrypted files. For example, the installer starts when the user causes the occurrence of a starting event, as by selecting an encrypted file with the mouse pointer and double-clicking on this file or the like (S<b>21</b>).

0112The installer judges whether or not the old edition of the game program <b>40</b>A that is to be updated has already been installed in the user computer <b>30</b> (S<b>22</b>). In cases where the old edition of the game program <b>40</b>A has not been installed, for example, a warning message such as “OLD EDITION OF GAME HAS NOT BEEN INSTALLED. PROCESSING WILL BE ENDED.” or the like is displayed on the screen, and the processing is ended (S<b>23</b>).

0113In cases where the old edition of the gram program <b>40</b>A has been installed in the user computer (S<b>22</b>: YES), a judgment is made as to whether or not the new edition of the game program <b>40</b> and the execution control program <b>50</b> are to be newly installed (S<b>24</b>). In cases where the new edition of the game program <b>40</b> and the execution control program <b>50</b> have been installed in the past, the view may be taken that user registration and fee processing have already been completed. Accordingly, as a result, it is judged in S<b>24</b> whether or not user registration and fee processing have already been completed.

0114In the case of installation for the first time, the function of the web browser <b>31</b> is called up and connected to the verification computer <b>20</b>, and the user is caused to perform user registration and fee processing (S<b>25</b>, S<b>26</b>).

0115Next, the installer ascertains the registry of the execution control program <b>50</b>, and in cases where the execution control program <b>50</b> has not yet been installed, the installer installs the execution control program <b>50</b> (S<b>27</b>). In order to rewrite the old edition of the game program <b>40</b>A as the new edition of the game program <b>40</b>, the installer rewrites the old editions of the program proper <b>41</b> and accompanying data group <b>42</b> as the new editions of the program proper <b>41</b> and accompanying data group <b>42</b> (S<b>28</b>, S<b>29</b>). Then, the installer starts the execution control program <b>50</b> and ends the processing (S<b>30</b>).

0116<figref idref="DRAWINGS">FIG. 6</figref> is a flow chart showing the execution control processing performed by the execution control program <b>50</b>, the processing of the verification computer <b>20</b> and the like.

0117The started execution control program <b>50</b> acquires machine information that is specific to the user computer <b>30</b> (in concrete terms, the MAC address) (S<b>41</b>). Furthermore, the execution control program <b>50</b> acquires current time information from an internal timer in the user computer <b>30</b>, and creates an encrypting key on the basis of this time information (S<b>42</b>).

0118Next, the execution control program <b>50</b> calls up the function of the web browser <b>31</b> (S<b>43</b>), makes a connection with the verification computer <b>20</b> via the communications network, and requests log-in verification from the verification computer <b>20</b> (S<b>44</b>). The execution control program <b>50</b> transmits the user ID, password, MAC address and encrypting key to the verification computer <b>20</b> (S<b>44</b>). The verification computer <b>20</b> refers to the user information data base <b>24</b>, and judges whether or not the user is a valid user (S<b>61</b>).

0119In cases where it is confirmed that the user is a valid user, the verification computer <b>20</b> creates list data listing the game programs that can be utilized by the user, and transmits this data to the user computer <b>30</b> (S<b>62</b>). Typically, game programs that have been purchased by the user may be cited as examples of game programs that can be utilized by the user. However, utilizable programs are not limited to such purchased programs; for example, game programs that are provided free of charge by software firms may also be included in such utilizable game programs.

0120When the execution control program <b>50</b> receives the list data of utilizable game programs from the verification computer <b>20</b>, the execution control program <b>50</b> causes a list of games to be displayed on the monitor display of the user computer <b>30</b> (S<b>45</b>). The user selects the game that he wishes to play on the basis of this list menu (S<b>46</b>).

0121The verification computer <b>20</b> refers to the game information data base <b>25</b>, creates starting information that is required in order to start the game program selected by the user, and encrypts this starting information by means of the encrypting key, MAC address and the like acquired in S<b>61</b> (S<b>63</b>). The verification computer <b>20</b> transmits the encrypted starting information to the execution control program <b>50</b> of the user computer <b>30</b> (S<b>64</b>).

0122When the execution control program <b>50</b> receives the encrypted starting information from the verification computer <b>20</b> (S<b>47</b>), the execution control program <b>50</b> decrypts this encrypted starting information by means of the encrypting key and the MAC address (S<b>48</b>).

0123Next, the execution control program <b>50</b> acquires registry information for the new edition of the game program <b>40</b> (S<b>49</b>), and creates a starting statement by means of the registry path and starting argument (S<b>50</b>).

0124Furthermore, the execution control program <b>50</b> decodes the encrypted new edition of the game program <b>40</b> by means of the decoding key extracted from the starting information, and develops this into a specified directory of a specified drive (S<b>51</b>). As a result, the game program <b>40</b> is decoded and placed in a state waiting for starting.

0125Then, the execution control program <b>50</b> starts the decoded new edition of the game program <b>40</b> by means of the starting statement created in S<b>50</b> (S<b>52</b>, S<b>70</b>). As a result, the user can play the new edition of the game program <b>40</b> (S<b>71</b>).

0126The execution control program <b>50</b> monitors the conditions of execution of the game program <b>40</b> (S<b>53</b>), and when the user finishes the game and ends the game program <b>40</b> (S<b>72</b>), the execution control program <b>50</b> disables the game program <b>40</b> by deleting the decoded program proper <b>41</b>, and ends the processing (S<b>54</b>).

0127Furthermore, in cases where the user again desires to play using the game program <b>40</b>, the user need merely access the verification computer <b>20</b> again, undergo on-line verification, and acquire starting information.

0128In the present embodiment constructed as described above, illegal use in which the use right is not purchased can be prevented even in the case of the distribution of downloading type software in which a program is stored in the user computer <b>30</b>.

0129Specifically, in the present embodiment, in order to start the game program <b>40</b>, it is necessary to perform on-line verification via the execution control program <b>50</b>, and to obtain driving information from the verification computer <b>20</b> via the communications network, each time that the game program <b>40</b> is used. Accordingly, even if the game program <b>40</b> alone is illegally copied by itself, this illegally copied game program cannot be started by itself.

0130Furthermore, the execution control program <b>50</b> is constructed as a program that is close to the OS side, as in a device driver, and therefore cannot be closed by ordinary methods as in the case of a device driver. Accordingly, the system is devised so that the execution control program <b>50</b> and gram program <b>40</b> cannot be separated and the game program <b>40</b> alone illegally copied or taken out.

0131The present invention can be used in various types of businesses. For example, by updating the old editions of game programs that were illegally copied and circulated in the past, it is possible to force illegal users to acquire use rights in a formal manner, thus converting such users into valid users. In order to cause illegal users to switch to new editions of game programs, it would be possible to stimulate the desire of such users to update by preparing accompanying data groups (game scenarios, music or the like) corresponding the users' native languages, or by newly preparing additional scenarios or the like.

0132Next, another embodiment will be described with reference to <figref idref="DRAWINGS">FIGS. 7 through 12</figref>. In the present embodiment, a case in which a game program is fixed to a storage medium and circulated will be described as an example. In the present embodiment, the description given in the abovementioned embodiment can be appropriately applied as long as this description does not restrict the scope of the present invention. In the present embodiment as in the abovementioned embodiment, the execution of the game program is controlled by means of an execution control program (game manager in the present embodiment) as will be described later. In addition, in the present embodiment, on-line verification between the verification computer (DRM computer in the present embodiment) and the execution control program can be performed periodically.

0133<figref idref="DRAWINGS">FIG. 7</figref> is an explanatory diagram which shows an overall outline of the software execution control system of the present embodiment. For example, as will be respectively described later, the present system can be constructed so that this system includes a supplier computer <b>100</b>, a DRM conversion computer <b>200</b>, and a user computer <b>300</b>.

0134For instance, the supplier computer <b>100</b> is used by a software vendor who produces program products. The supplier computer <b>100</b> comprises a DRM part <b>110</b> that processes the game program <b>400</b> and converts this program into a DRM program <b>700</b>. Here, “DRM” is an abbreviation for “digital rights management”, and refers to the management of rights to the digitized contents of programs such as game programs or the like. In the present specification, “DRM conversion” refers to a process whereby resistance to improper use and the like is improved by setting individual protection (described later) for non-protected game programs.

0135The DRM part <b>110</b> sets individual protection for the game program <b>400</b> by adding a game manager <b>500</b> and a monitoring program <b>600</b> to the game program <b>400</b>. The protected game program <b>400</b> is taken as a DRM-converted program <b>700</b>, and is recorded on a recording medium RM and circulated on the market. The game manager <b>500</b> and monitoring program <b>600</b> will be further described later.

0136Various types of media such as CD-ROMs, DVD-ROMs, optical disks, hard disks, flexible disks, semiconductor memories, magnetic tapes and the like can be appropriately used as the recording medium RM. The DRM-converted program <b>700</b> may be compressed and recorded on the recording medium RM, or the DRM-converted program <b>700</b> may be recorded on the recording medium RM without being compressed. Furthermore, the installer that is used to install the DRM-converted program <b>700</b> in the user computer <b>300</b> can also be stored on the recording medium RM.

0137The DRM conversion computer <b>200</b> is one example of a “management computer”. For example, the DRM conversion computer <b>200</b> can also be called a “verification management server”. A DRM conversion computer <b>200</b> may be provided for each software vendor, or a single DRM conversion computer <b>200</b> may be provided for a plurality of software vendors.

0138The DRM conversion computer <b>200</b> transmits user verification and starting information, and manages the continued execution, by performing communications with the game manager <b>500</b> that operates in the user computer <b>300</b>. The DRM conversion computer <b>200</b> comprises a verification part <b>210</b>, an operating information transmission part <b>220</b>, and a continued-execution management part <b>230</b>.

0139Furthermore, the DRM conversion computer <b>200</b> can utilize the user information data base <b>240</b>, game information data base <b>250</b>, and monitoring condition data base <b>260</b>. Moreover, the DRM conversion computer <b>200</b> need not be physically constructed from a single computer; this computer may also be realized by the cooperative operation of a plurality of computers.

0140Like the verification part <b>21</b> of the abovementioned embodiment, the verification part <b>210</b> performs user verification on the basis of verification data that is transmitted from the game manager <b>500</b> such as (for example) the user ID and password (shown as “PW” in the figures). Furthermore, like the starting information transmission part <b>23</b> in the abovementioned embodiment, the starting information transmission part <b>220</b> transmits to the game manager <b>500</b> (for example) information that is required for the game manager <b>500</b> to decode the game program <b>400</b> and place this game program <b>400</b> in a state that allows starting.

0141The continued-execution management part <b>230</b> manages whether or not the execution of the game program <b>400</b> is continued by performing communications with the game manager <b>500</b> at specified times. Details will be further described later; however, the continued-execution management part <b>230</b> compares a session ID that is transmitted from the game manager <b>500</b> with a session ID that is stored beforehand, and allows continuation of the execution of the game program <b>400</b> in cases where both IDs agree. Conversely, in cases where the two session IDs do not agree, the continued execution processing <b>230</b> instructs the game manager <b>500</b> to forcibly end the game program <b>400</b>.

0142Like the user computer <b>3</b> of the abovementioned embodiment, the user computer <b>300</b> can be constructed as a personal computer, portable information terminal or portable telephone. The user computer <b>300</b> may comprise hardware resources and software resources as required, such as a CPU, memory, auxiliary storage device, OS, various types of device drivers and the like. The game program <b>400</b>, game manager <b>500</b> and monitoring program <b>600</b> can appropriately utilize hardware resources and software resources of the user computer <b>300</b>.

0143The game program <b>400</b>, game manager <b>500</b> and monitoring program <b>600</b> are respectively performed in the user computer <b>300</b> by reading the stored contents of the recording medium RM into the user computer <b>300</b> and performing specified installation processing. For a user with proper authorization, the game manager <b>500</b> acts as a launcher program for starting the game program <b>400</b>. However, the game manager <b>500</b> is not a simple launcher program, but controls the operation of the game program <b>400</b>. Furthermore, the game manager <b>500</b> respectively monitors the operating conditions of the game program <b>400</b> and monitoring program <b>600</b>, and in cases where either of the objects of monitoring ceases operation, the game manager <b>500</b> shuts down the operation of the other object of monitoring, and shuts down its own operation.

0144The monitoring program <b>600</b> respectively monitors the operating conditions of the game program <b>400</b> and the game manager <b>500</b>, and in cases where either of these objects of monitoring ceases to operate, the monitoring program <b>600</b> shuts down the operation of the other object of monitoring, and shuts down its own operation. A valid user can use the game program <b>400</b> without being aware of the existence of the monitoring program <b>600</b>.

0145<figref idref="DRAWINGS">FIG. 8</figref> is an explanatory diagram showing one example of the respective data bases <b>240</b> through <b>260</b>. As is shown in <figref idref="DRAWINGS">FIG. 8(a)</figref>, for example, the user information data base <b>240</b> can associated and manage the user ID, password, MAC address, session ID and other information. As will be described later, the session ID is information that is used to judge whether or not continued execution is permitted. Specifically, in order to prevent the game program <b>400</b> from being improperly performed using a user computer that is separate from the user computer <b>300</b> that was initially verified, the game manager <b>500</b> and DRM conversion computer <b>200</b> periodically perform communications. In this case, the session ID that is received from the game manager <b>500</b> is compared with the session ID that is registered in the user information data base <b>240</b>, and continuation of the execution of the game program <b>400</b> is permitted only when these session IDs agree. Furthermore, as in the case of the user information data base <b>24</b> shown in <figref idref="DRAWINGS">FIG. 2(a)</figref>, a plurality of MAC addresses may be associated with a single user ID.

0146As is shown in <figref idref="DRAWINGS">FIG. 8(b)</figref>, the game information data base <b>250</b> can be managed by (for example) associating game IDs, game names, game information, decoding keys (activating keys), starting arguments and reporting modes. Here, the term “reporting mode” refers to information that sets the policy relating to periodic reporting to the DRM conversion computer from the game manager <b>500</b>. For example, the reporting mode can be set by the provider (software vendor) of the game program <b>400</b>.

0147Here, examples of reporting modes that can be used include a mode in which a report is made to the DRM conversion computer <b>200</b> only when the game program <b>400</b> is initially started, a mode in which a report is made to the DRM conversion computer <b>200</b> each time that the game program <b>400</b> is started, a mode in which a report is made to the DRM conversion computer <b>200</b> at as short a period as possible with priority given to the monitoring efficiency, and a mode in which a report is made to the DRM conversion computer <b>200</b> at a low frequency with consideration given to reducing the burden on the DRM conversion computer <b>200</b>.

0148As is shown in <figref idref="DRAWINGS">FIG. 8(c)</figref>, the monitoring condition data base can be managed by associating (for example) the user IDs of the respective users executing the game program <b>400</b>, the reporting periods from the respective user computers <b>300</b>, the next reporting time, the game IDs of the game programs <b>400</b> executed by the respective users, and the game starting times. As will be described later, the next reporting time is actively controlled on the basis of the burden conditions, reporting mode and the like of the DRM conversion computer <b>200</b>.

0149Next, the operation of this system will be described with reference to <figref idref="DRAWINGS">FIGS. 9 through 12</figref>. First, <figref idref="DRAWINGS">FIG. 9</figref> is a flow chart showing an outline of the operation that is performed when this system is started.

0150For example, the user desiring to utilize a game program <b>400</b> selects the game icon representing the desired game program <b>400</b>, and gives instructions to start this game program <b>400</b>. When the operation performed by this user is detected, the game manager <b>500</b> first starts (S<b>101</b>).

0151The game manager <b>500</b> acquires the MAC address which is one example of machine information that is specific to the user computer <b>300</b> (S<b>102</b>), and transmits this MAC address to the DRM conversion computer <b>200</b> via the communications network CN (S<b>103</b>).

0152The DRM conversion computer <b>200</b> registers the MAC address received from the game manager <b>500</b> in the user information data base <b>240</b> (S<b>121</b>, S<b>122</b>). At this point in time, only the MAC address has been ascertained; there is no association with the user ID or the like. Furthermore, it would also be possible to hold the MAC address in memory without registering this address in the user information data base <b>240</b>, and then to register the MAC address in the user information data base <b>240</b> together with the user ID, session ID or the like in cases where user verification is successful.

0153The DRM conversion computer <b>200</b> issues a session ID, and further sets the reporting period. An initial value that is set beforehand can be used as the initially set reporting period. Then, the DRM conversion computer <b>200</b> notifies the game manager <b>500</b> of the session ID and initial reporting period (S<b>123</b>).

0154When the game manager <b>500</b> receives the session ID and reporting period (S<b>104</b>), the game manager <b>500</b> stores and holds these sets of information in the memory of the user computer <b>300</b>. Next, the game manager <b>500</b> judges whether or not the user ID and password have been input (S<b>105</b>). For example, the user can be prompted to input such a user ID and password by displaying a screen that requests the input of this user ID and password when the user selects a game icon.

0155When the game manager <b>500</b> recognizes the input of a user ID and password (S<b>105</b>: YES), the game manager <b>500</b> transmits the input user ID and password, and the game ID of the game program <b>400</b> that the user wishes to execute, to the DRM conversion computer <b>200</b> (S<b>106</b>).

0156When the DRM conversion computer <b>200</b> receives the user ID, password and game ID from the game manager <b>500</b> (S<b>124</b>), the DRM conversion computer <b>200</b> refers to the user information data base <b>240</b>, and performs user verification (S<b>125</b>). In cases where the user ID and password registered beforehand agree with the user ID and password received from the game manager <b>500</b> (S<b>125</b>: YES), user verification is successful. The DRM conversion computer <b>200</b> registers the user ID, password, MAC address and the like in association with each other in the user information data base <b>240</b> (S<b>127</b>). Conversely, in cases where either the user IDs or the passwords do not agree (S<b>125</b>: NO), user verification fails, and error processing is performed (S<b>126</b>). Conceivable error processing includes the display of a message such as “ID OR PASSWORD IS DIFFERENT” on the screen of the user computer <b>300</b>. Furthermore, for example, in cases where user verification fails a specified number of times or more, the starting of the game program <b>400</b> can be locked. Moreover, user verification information is not limited to the user ID and password; for example, biological information such as voice, fingerprints, iris images or the like can also be used.

0157As a result of the success of user verification, the DRM conversion computer <b>200</b> determines that the game program <b>400</b> desired by the user can be executed (S<b>128</b>). The DRM conversion computer <b>200</b> creates and encrypts information that is used to allow the game manager <b>500</b> to start the game program <b>400</b> whose execution is permitted (S<b>129</b>). Examples of such game starting information include execution information such as file names or the like, activating keys and the like. For example, the DRM conversion computer <b>200</b> encrypts such execution information and activating keys using the session ID and user information (MAC addresses or the like), and transmits this encrypted information to the game manager <b>500</b> (S<b>130</b>).

0158When the game manager <b>500</b> receives encrypted information from the DRM conversion computer <b>200</b> (S<b>107</b>), the game manager <b>500</b> decrypts the encrypted information (S<b>108</b>), and acquires the activating key and execution information (S<b>109</b>). The encryption algorithm used by the DRM conversion computer <b>200</b> is known to the game manager <b>500</b>, and the information required for decryption is also present on the side of the user computer <b>300</b>; accordingly, the encrypted information can be decrypted.

0159The game manager <b>500</b> decodes the game program <b>400</b> by means of the acquired activating key, and stores this decoded game program <b>400</b> in the memory of the user computer <b>300</b> (S<b>110</b>).

0160Specifically, in cases where the game program <b>400</b> is installed in the user computer <b>300</b>, the game program, for example, is recorded in an encoded state in the auxiliary storage device of the user computer <b>300</b>. In this encoded state, the game program <b>400</b> cannot be started. The game program <b>400</b> can be started at the point in time at which the game manager <b>500</b> has acquired the activating key from the DRM conversion computer <b>200</b>, decoded the game program <b>400</b>, and stored this game program in the memory of the user computer <b>300</b>. Here, it should be noted that the decoded game program <b>400</b> (program that is to be executed) is not stored as a file, but is present only in the memory. Since programs in the memory are deleted at the time that the game program <b>400</b> is completed, it is necessary to acquire user verification and an activating key again via the game manager <b>500</b> in cases where the game is to be played again.

0161Furthermore, the game manager <b>500</b> starts the game program <b>400</b> placed in the memory of the user computer <b>300</b> on the basis of the execution information (S<b>111</b>). As a result, the user can execute and play the game program <b>400</b>. Furthermore, at the same time that the game program <b>400</b> is started (this need not be simultaneous in a strict physical sense), the game manager <b>500</b> also starts the monitoring program <b>600</b> (S<b>112</b>). The operation of the monitoring program <b>600</b> will be further described later.

0162Next, the processing for controlling the continuation of the execution of the game program <b>400</b> will be described with reference to <figref idref="DRAWINGS">FIG. 10</figref>.

0163The game manager <b>500</b> refers to the reporting period that is set by the DRM conversion computer <b>200</b> at the time of starting (S<b>141</b>). By utilizing a timer function or the like of the user computer <b>300</b>, the game manager <b>500</b> judges whether or not the reporting time preset by the DRM conversion computer <b>200</b> has arrived (S<b>142</b>).

0164In cases where the reporting time has arrived (S<b>142</b>: YES), the game manager <b>500</b> reads out the session ID set by the DRM conversion computer <b>200</b> from the memory of the user computer <b>300</b> (S<b>143</b>), and transmits this read-out session ID to the DRM conversion computer <b>200</b> (S<b>144</b>).

0165When the DRM conversion computer <b>200</b> receives the session ID from the game manager <b>500</b> (S<b>161</b>), the DRM conversion computer <b>200</b> refers to the user information data base <b>240</b>. The DRM conversion computer <b>200</b> compares the issued session ID registered in the user information data base <b>240</b> with the session ID received from the game manager <b>500</b>, and judges whether or not the two IDs agree (S<b>163</b>). Furthermore, the game manager <b>500</b> may transmit only the session ID to the DRM conversion computer <b>200</b>, or may include all or part of the user information such as the user ID and the like in addition to the session ID. Furthermore, environmental information relating to the user computer <b>300</b> (CPU utilization rate, amount of memory consumption or the like) may also be included. However, as the amount of information added to the session ID increases, the burden on the user computer <b>300</b> also increases, as does the network traffic.

0166In cases where the session ID received from the game manager <b>500</b> does not agree with the session ID registered beforehand (S<b>163</b>: NO), the DRM conversion computer <b>200</b> (continued-execution management part <b>230</b>) notifies the game manager <b>500</b> that continuation of the execution of the game program <b>400</b> is prohibited (S<b>164</b>). Cases in which the two session IDs do not agree are cases in which the game program <b>400</b> is executed using a different user computer or the like, i.e., cases in which the same game program <b>400</b> is started a plurality of times using one user ID. Accordingly, in cases where the two session IDs do not agree, the game manager <b>500</b> is instructed to end the game program <b>400</b> forcibly.

0167In cases where the session ID received from the game manager <b>500</b> agrees with the session ID registered beforehand (S<b>163</b>: YES), the DRM conversion computer <b>200</b> calculates a new reporting period, i.e., the next reporting time (S<b>165</b>). The calculation of this new reporting period will be further described later; however, this is determined with the load conditions of the DRM conversion computer <b>200</b> and the like being taken into account.

0168In cases where both session IDs agree, the DRM conversion computer <b>200</b> notifies the game manager <b>500</b> of the newly calculated reporting period and the permission to continue execution (S<b>166</b>).

0169The game manager <b>500</b> receives a response from the DRM conversion computer <b>200</b> regarding the possibility of continuing execution (S<b>145</b>). In cases where continuation of the execution of the game program <b>400</b> is permitted (S<b>146</b>: YES), the newly set reporting period is stored in the memory of the user computer <b>300</b>, and the processing returns to S<b>141</b> and waits for the arrival of the reporting time.

0170Conversely, in cases where the continuation of execution is prohibited by the DRM conversion computer <b>200</b> (S<b>146</b>: NO), the fm <b>500</b> forcibly ends the game program <b>400</b> that is in execution (S<b>147</b>). Furthermore, after ending the monitoring program <b>600</b> (S<b>148</b>), the game manager <b>500</b> also shuts itself down (S<b>149</b>).

0171Thus, the game manager <b>500</b> periodically performs a simple verification with the DRM conversion computer <b>200</b>. As a result, for example, improper utilization in which a plurality of game programs <b>400</b> are started using the same user ID and password can be prevented.

0172<figref idref="DRAWINGS">FIG. 11</figref> is a flow chart showing the setting processing of the reporting period. This is one example of the concrete realization of the contents of S<b>165</b> in <figref idref="DRAWINGS">FIG. 10</figref>. The DRM conversion computer <b>200</b> (more specifically, the continued-execution management part <b>230</b>) refers to the point in time at which the session ID is received from the game manager <b>500</b> (S<b>181</b>). Next, the game manager <b>500</b> refers to the reporting period that is associated with the reception of this session ID (S<b>182</b>).

0173The game manager <b>500</b> calculates the deviation between the point in time at which the session ID is received and the preset reporting period. For example, in cases where the point in time of actual session ID reception is later than the planned point in time of session ID reception, possible causes of this include delay of packet arrival due to complexity of the communications network CN, a drop in the response performance due to an increase in the burden on the DRM conversion computer <b>200</b> and the like.

0174The DRM conversion computer <b>200</b> detects its own current load conditions (S<b>184</b>). Examples of such load conditions include the number of users currently playing, i.e., the number of game managers that are to be subjected to periodic verification processing on-line and the like. In addition to this, for example, the CPU utilization rate, amount of memory consumption, data input-output processing rate (I/O rate) and the like may also be detected.

0175The DRM conversion computer <b>200</b> predicts future load conditions on the basis of the current load conditions (S<b>185</b>). Specifically, in cases where the reporting period of the game manager <b>500</b> is maintained at the current value, the load conditions of the DRM conversion computer <b>200</b> at the next reporting time are predicted. In concrete terms, for example, in a case where the current reporting period is set at “1 hour”, the number of users (number of game managers) undergoing on-line verification after 1 hour has elapsed from the current point in time can be grasped by means of the monitoring condition data base <b>260</b>.

0176Next, the DRM conversion computer <b>200</b> refers to the reporting mode that is set beforehand for the game program <b>400</b> in execution (S<b>186</b>). The reporting mode associated with the game program <b>400</b> can be altered even after the recording medium RM is circulated on the market. For example, the DRM conversion computer <b>200</b> can be notified of the game ID and new reporting mode by the supplier computer <b>100</b>, and alteration of the game information data base <b>250</b> can be requested.

0177Finally, for example, the DRM conversion computer <b>200</b> calculates the new reporting period on the basis of the reporting mode, amount of time deviation between the planned point in time of the session ID reception and actual point in time of this reception, and future predicted load conditions so that the monitoring efficiency is maximized (S<b>187</b>).

0178For example, when a newly created popular game program is first placed on the market, the number of users of this game program increases abruptly. Accordingly, the burden on the DRM conversion computer <b>200</b> which performs a simple periodic verification on-line shows an increase. Security against improper use is improved as the reporting period is set as a shorter period; on the other hand, however, the burden on the DRM conversion computer <b>200</b> is also increased. If the reporting period is set as too short a period because of the emphasis on security, the response characteristics of the DRM conversion computer <b>200</b> deteriorate, and there is a possibility that this will lead to a shutdown of the function. Accordingly, in cases where there is a temporary increase in the load, as in the initial marketing of a newly created popular game or the like, the system is controlled so that the reporting period is lengthened.

0179Thus, for example, in the case of monitoring priority mode, the DRM conversion computer <b>200</b> can set the reporting period (monitoring timing) so that maximum security can be obtained within limits that do not cause a shutdown of the function. On the other hand, in the case of load reduction mode, the DRM conversion computer <b>200</b> can set the reporting period at a period that makes it possible to maintain at least minimum security.

0180The above is one example; various algorithms can be introduced for the prediction of the load conditions, setting of the reporting period and the like.

0181Next, <figref idref="DRAWINGS">FIG. 12</figref> is a flow chart which shows the mutual monitoring processing performed by the game manager <b>500</b> and monitoring program <b>600</b>. In this embodiment, the game manager <b>500</b> and monitoring program <b>600</b> respectively monitor the operating conditions of the game program <b>400</b> as a shared object of monitoring; in addition, these parts also periodically monitor each other as objects of monitoring. If periodic on-line verification between the DRM conversion computer <b>200</b> and game manager <b>500</b> is taken as monitoring from the outside, then the mutual monitoring of the game manager <b>500</b> and monitoring program <b>600</b> can be positioned as internal monitoring.

0182To describe the monitoring processing of the game manager <b>500</b> first, the game manager <b>500</b> judges whether or not the preset monitoring time has arrived (S<b>201</b>). It is desirable to set the monitoring time with a relatively short period. When the monitoring time arrives (S<b>201</b>: YES), the game manager <b>500</b> checks the operating conditions of the monitoring program <b>600</b> (S<b>203</b>), and judges whether or not the monitoring program <b>600</b> is operating normally (S<b>203</b>).

0183In cases where the monitoring program <b>600</b> is operating normally (S<b>203</b>: YES), the game manager <b>500</b> next checks the operating conditions of the game program <b>400</b> (S<b>204</b>), and judges whether or not the game program <b>400</b> is operating normally (S<b>205</b>). In cases where the game program <b>400</b> is also operating normally (S<b>205</b>: YES), the game manager <b>500</b> waits until the next monitoring time arrives (S<b>201</b>).

0184On the other hand, in cases where the monitoring program <b>600</b> has stopped operating (S<b>203</b>: NO), or in cases where the game program <b>400</b> has stopped operating (S<b>205</b>: NO), the game manager <b>500</b> shifts to forcible stop processing (S<b>206</b> through S<b>208</b>).

0185Specifically, after the game manager <b>500</b> stops the operation of both the game program <b>400</b> and the monitoring program <b>600</b> (S<b>206</b>, S<b>207</b>), the game manager <b>500</b> also shuts itself down (S<b>208</b>). In cases where the operation of the game program <b>400</b> is stopped, the decoded game program <b>400</b> is immediately deleted from the memory of the user computer <b>300</b> and destroyed.

0186Furthermore, in the case of programs that have already stopped, there is no need to order stopping again. For example, in a case where stopping of the operation of the game program <b>400</b> has been confirmed, and the processing has shifted to forcible stop processing, there is no need to order the stopping of the operation of the game program <b>400</b> again. Similarly, in a case where the stopping of the operation of the monitoring program <b>600</b> has been confirmed, and the processing has shifted to forcible stop processing, there is no need to order the stopping of the operation of the monitoring program <b>600</b> again. However, stopping of the operation of both the game program <b>400</b> and monitoring program <b>600</b> may be order to ensure stopping.

0187The same is true of the processing of the monitoring program <b>600</b>. When the monitoring time arrives (S<b>221</b>: YES), the monitoring program <b>600</b> respectively monitors the operating conditions of the game manager <b>500</b> and game program <b>400</b> (S<b>222</b> through S<b>225</b>), and in cases where either of these has stopped operating (S<b>223</b>: NO, or S<b>225</b>: NO), the monitoring program <b>600</b> shifts to forcible stop processing, and shuts down all of the programs (S<b>226</b> through S<b>228</b>).

0188Thus, since a plurality of operating monitoring programs, i.e., the game manager <b>500</b> and monitoring program <b>600</b>, monitor the operating conditions of the game program <b>400</b>, and also monitor each other, the stopping of the operation of the game program <b>400</b> can be more reliably detected. Furthermore, even in cases where one of the operation monitoring programs is intentionally shut down, the other monitoring program can perform an overall shutdown, so that improper copying of the game program <b>400</b> opened in the memory of the user computer <b>300</b> can be prevented in advance.

0189In the present embodiment, as was described above in detail, periodic on-line verification is performed between the game manager <b>500</b> that controls the operation of the game program <b>400</b> and the DRM conversion computer <b>200</b> that performs license verification; accordingly, the durability against improper use can be increased.

0190Furthermore, since this periodic on-line verification is performed by comparing session IDs, this can be accomplished by relatively simple processing. Accordingly, a simple verification can be performed in a relatively short time without increasing the burden on the computers, and security can be maintained over a long period of time.

0191In addition, the timing at which this simple on-line verification is performed (i.e., the reporting period) is actively controlled on the basis of the load conditions of the DRM conversion computer <b>200</b> and the like; accordingly, higher security can be realized while taking into account the network traffic, computer load and the like.

0192Moreover, a construction is used in which two respectively independent operation monitoring programs, i.e., the game manager <b>500</b> and monitoring program <b>600</b>, are prepared, and these programs can monitor not only the operating conditions of the game program <b>400</b>, but also each other, so that in cases where even one of the programs, i.e., the game program <b>400</b>, game manager <b>500</b> or monitoring program <b>600</b>, stops operating, the operation of the other two programs can also be stopped, and the game program <b>400</b> can be disabled by being deleted or the like; accordingly, actions such as the improper read-out and copying of the game program <b>400</b> opened in the memory can be prevented, and reliability can be further heightened.

0193Next, <figref idref="DRAWINGS">FIG. 13</figref> shows still another embodiment of the present invention. This embodiment has a construction in which mutual monitoring by a plurality of monitoring programs and periodic on-line verification with a verification computer are realized in the first embodiment.

0194In this embodiment, a game program <b>40</b>, execution control program <b>50</b>A and monitoring program <b>60</b> are distributed to a user computer <b>30</b> from a distribution computer <b>10</b>.

0195In addition to the construction and effects of the abovementioned execution control program <b>50</b>, the execution control program <b>50</b>A comprises an easy periodic on-line verification function and a monitoring function that are performed by the abovementioned game manager <b>500</b>. Furthermore, the monitoring program <b>60</b> comprises a monitoring function similar to that of the abovementioned monitoring program <b>600</b>.

0196The execution control program <b>50</b>A performs decoding of the game program <b>40</b> and the like by means of an initial user verification. Furthermore, the execution control program <b>50</b>A also performs user verification during the execution of the game program <b>40</b> by periodically transmitting a session ID to the to the verification computer <b>20</b>. In cases where the user verification is successful, the execution control program <b>50</b>A permits continuous execution of the game program <b>40</b>, while in cases where the user verification fails, the execution control program <b>50</b>A forcibly ends the game program <b>40</b>.

0197Furthermore, the execution control program <b>50</b>A and monitoring program <b>60</b> both monitor the starting conditions of the game program <b>40</b>, and also respectively monitor each other. Moreover, in cases where even one of the programs, i.e., the game program <b>40</b>, execution control program <b>50</b>A or monitoring program <b>60</b>, ends, the execution control program <b>50</b>A or monitoring program <b>60</b> detects this, and shuts down the remaining programs and itself.

0198Furthermore, the respective embodiments of the present invention described above are examples used to describe the present invention; the scope of the present invention is not limited to these embodiments alone. A person skilled in the art can work the present invention in various aspects without departing from the spirit of the present invention.